Merge branch 'master' of gitee.com:openharmony/inputmethod_imf into master

Signed-off-by: Hollokin <taoyuxin2@huawei.com>

frameworks/inputmethod_controller/src/input_method_controller.cpp

@@ -242,8 +242,7 @@ using namespace MessageID;
     void InputMethodController::QuitWorkThread()
     {
         stop_ = true;
-        MessageParcel *parcel = new MessageParcel();
-        Message *msg = new Message(MessageID::MSG_ID_QUIT_WORKER_THREAD, parcel);
+        Message *msg = new Message(MessageID::MSG_ID_QUIT_WORKER_THREAD, nullptr);
         msgHandler->SendMessage(msg);
         if (workThreadHandler.joinable()) {
             workThreadHandler.join();

interfaces/kits/js/napi/inputmethodability/js_input_method_engine_setting.cpp

@@ -255,7 +255,7 @@ void JsInputMethodEngineSetting::UnRegisterListener(napi_value callback, std::st
         return;
     }
 
-    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end();) {
+    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end(); item++) {
         if (Equals((*item)->env_, callback, (*item)->callback_, (*item)->threadId_)) {
             jsCbMap_[type].erase(item);
             break;

interfaces/kits/js/napi/inputmethodability/js_keyboard_delegate_setting.cpp

@@ -205,7 +205,7 @@ void JsKeyboardDelegateSetting::UnRegisterListener(napi_value callback, std::str
         return;
     }
 
-    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end();) {
+    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end(); item++) {
         if ((callback != nullptr) && (Equals((*item)->env_, callback, (*item)->callback_, (*item)->threadId_))) {
             jsCbMap_[type].erase(item);
             break;

interfaces/kits/js/napi/inputmethodclient/js_get_input_method_setting.cpp

@@ -484,7 +484,7 @@ void JsGetInputMethodSetting::UnRegisterListener(napi_value callback, std::strin
         return;
     }
 
-    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end();) {
+    for (auto item = jsCbMap_[type].begin(); item != jsCbMap_[type].end(); item++) {
         if (Equals((*item)->env_, callback, (*item)->callback_, (*item)->threadId_)) {
             jsCbMap_[type].erase(item);
             break;

test/fuzztest/BUILD.gn

@@ -24,6 +24,7 @@ group("fuzztest") {
     "inputclientstub_fuzzer:fuzztest",
     "inputmethodability_fuzzer:fuzztest",
     "inputmethodcontroller_fuzzer:fuzztest",
+    "inputmethodsetting_fuzzer:fuzztest",
     "platformcallbackstub_fuzzer:fuzztest",
     "systemabilitystub_fuzzer:fuzztest",
   ]

test/fuzztest/inputmethodsetting_fuzzer/BUILD.gn

@@ -0,0 +1,70 @@
+# Copyright (c) 2021 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//base/inputmethod/imf/inputmethod.gni")
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/ohos.gni")
+import("//build/test.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("InputMethodSettingFuzzTest") {
+  module_out_path = "inputmethod/inputmethod"
+
+  fuzz_config_file =
+      "//base/inputmethod/imf/test/fuzztest/inputmethodsetting_fuzzer"
+
+  include_dirs = [
+    "//base/inputmethod/imf/services/include",
+    "//foundation/ability/ability_runtime/interfaces/inner_api/app_manager/include/appmgr",
+    "//foundation/ability/ability_runtime/services/abilitymgr/include",
+    "//foundation/ability/ability_runtime/interfaces/inner_api/ability_manager/include/",
+    "//third_party/jsoncpp/include/",
+    "//foundation/bundlemanager/bundle_framework/interfaces/inner_api/appexecfwk_core/include/bundlemgr",
+    "//foundation/multimedia/image_framework/interfaces/innerkits/include",
+  ]
+
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+
+  sources = [ "inputmethodsetting_fuzzer.cpp" ]
+
+  deps = [
+    "${ability_runtime_services_path}/abilitymgr:abilityms",
+    "//base/inputmethod/imf/frameworks/inputmethod_controller:inputmethod_client",
+    "//base/inputmethod/imf/services:inputmethod_service",
+    "//foundation/communication/ipc/interfaces/innerkits/ipc_core:ipc_core",
+  ]
+
+  external_deps = [
+    "bundle_framework:appexecfwk_core",
+    "c_utils:utils",
+    "hiviewdfx_hilog_native:libhilog",
+  ]
+}
+
+###############################################################################
+group("fuzztest") {
+  testonly = true
+  deps = []
+  deps += [
+    # deps file
+    ":InputMethodSettingFuzzTest",
+  ]
+}
+###############################################################################

test/fuzztest/inputmethodsetting_fuzzer/corpus/init

@@ -0,0 +1,14 @@
+# Copyright (c) 2022 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FUZZ

test/fuzztest/inputmethodsetting_fuzzer/inputmethodsetting_fuzzer.cpp

@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2022 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "inputmethodsetting_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+
+#include "peruser_session.h"
+#include "peruser_setting.h"
+#include "input_method_system_ability.h"
+#include "input_method_setting.h"
+#include "input_method_controller.h"
+#include "global.h"
+
+#include "message_parcel.h"
+
+using namespace OHOS::MiscServices;
+namespace OHOS {
+    class TextListener : public OnTextChangedListener {
+    public:
+        TextListener() {}
+        ~TextListener() {}
+        void InsertText(const std::u16string& text) {}
+        void DeleteBackward(int32_t length) {}
+        void SetKeyboardStatus(bool status) {}
+        void DeleteForward(int32_t length) {}
+        void SendKeyEventFromInputMethod(const KeyEvent& event) {}
+        void SendKeyboardInfo(const KeyboardInfo& status) {}
+        void MoveCursor(const Direction direction) {}
+    };
+    bool FuzzInputMethodSetting(const uint8_t* rawData, size_t size)
+    {
+        sptr<InputMethodController> imc = InputMethodController::GetInstance();
+        sptr<OnTextChangedListener> textListener = new TextListener();
+        imc->Attach(textListener);
+
+        constexpr int32_t MAIN_USER_ID = 100;
+        PerUserSetting *setting = new (std::nothrow) PerUserSetting(MAIN_USER_ID);
+        if (setting == nullptr) {
+            return true;
+        }
+        InputMethodSetting *methodSetting = setting->GetInputMethodSetting();
+        if (methodSetting == nullptr) {
+            return true;
+        }
+
+        InputMethodSetting setting_ = *methodSetting;
+        std::u16string imeId = Str8ToStr16(std::string(rawData, rawData + size));
+        std::vector<int32_t> types;
+        for (size_t i = 0; i < size; ++i) {
+            types.push_back(static_cast<int32_t>(*rawData));
+        }
+        setting_.GetCurrentInputMethod();
+        setting_.SetCurrentInputMethod(imeId);
+        setting_.GetEnabledInputMethodList();
+        setting_.AddEnabledInputMethod(imeId, types);
+        setting_.RemoveEnabledInputMethod(imeId);
+        setting_.GetEnabledKeyboardTypes(imeId);
+        setting_.GetCurrentKeyboardType();
+        setting_.SetCurrentKeyboardType(static_cast<int32_t>(*rawData));
+        setting_.GetCurrentSysKeyboardType();
+        setting_.SetCurrentSysKeyboardType(static_cast<int32_t>(*rawData));
+        setting_.FindKey(imeId);
+        setting_.ClearData();
+
+        delete setting;
+        setting = nullptr;
+        return true;
+    }
+}
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    /* Run your code on data */
+    OHOS::FuzzInputMethodSetting(data, size);
+    return 0;
+}

test/fuzztest/inputmethodsetting_fuzzer/inputmethodsetting_fuzzer.h

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2022 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef TEST_FUZZTEST_INPUTMETHODSETTING_FUZZER_INPUTMETHODSETTING_FUZZER_H
+#define TEST_FUZZTEST_INPUTMETHODSETTING_FUZZER_INPUTMETHODSETTING_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "inputmethodsetting_fuzzer"
+
+#endif // TEST_FUZZTEST_INPUTMETHODSETTING_FUZZER_INPUTMETHODSETTING_FUZZER_H

test/fuzztest/inputmethodsetting_fuzzer/project.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2022 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>

test/fuzztest/systemabilitystub_fuzzer/BUILD.gn

@@ -45,13 +45,17 @@ ohos_fuzztest("SystemAbilityStubFuzzTest") {
   sources = [ "systemabilitystub_fuzzer.cpp" ]
 
   deps = [
+    "//base/inputmethod/imf/frameworks/inputmethod_controller:inputmethod_client",
     "//base/inputmethod/imf/services:inputmethod_service",
+    "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc",
     "//foundation/ability/ability_runtime/services/abilitymgr:abilityms",
     "//foundation/communication/ipc/interfaces/innerkits/ipc_core:ipc_core",
     "//foundation/communication/ipc/interfaces/innerkits/ipc_single:ipc_single",
   ]
 
   external_deps = [
+    "access_token:libaccesstoken_sdk",
+    "access_token:libnativetoken",
     "bundle_framework:appexecfwk_core",
     "c_utils:utils",
     "hiviewdfx_hilog_native:libhilog",

test/fuzztest/systemabilitystub_fuzzer/project.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (c) 2021 Huawei Device Co., Ltd.
+<!-- Copyright (c) 2022 Huawei Device Co., Ltd.
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.

test/fuzztest/systemabilitystub_fuzzer/systemabilitystub_fuzzer.cpp

@@ -13,19 +13,74 @@
  * limitations under the License.
  */
 
-
 #include "systemabilitystub_fuzzer.h"
 
 #include <cstddef>
 #include <cstdint>
 
 #include "input_method_system_ability.h"
+#include "input_method_controller.h"
+#include "accesstoken_kit.h"
+#include "token_setproc.h"
+#include "nativetoken_kit.h"
 #include "global.h"
 
 #include "message_parcel.h"
 
+using namespace OHOS::Security::AccessToken;
 using namespace OHOS::MiscServices;
 namespace OHOS {
+    void GrantNativePermission()
+    {
+        const char **perms = new const char *[1];
+        perms[0] = "ohos.permission.CONNECT_IME_ABILITY";
+        TokenInfoParams infoInstance = {
+            .dcapsNum = 0,
+            .permsNum = 1,
+            .aclsNum = 0,
+            .dcaps = nullptr,
+            .perms = perms,
+            .acls = nullptr,
+            .processName = "inputmethod_imf",
+            .aplStr = "system_core",
+        };
+        uint64_t tokenId = GetAccessTokenId(&infoInstance);
+        int res = SetSelfTokenID(tokenId);
+        if (res == 0) {
+            IMSA_HILOGI("SetSelfTokenID success!");
+        } else {
+            IMSA_HILOGE("SetSelfTokenID fail!");
+        }
+        AccessTokenKit::ReloadNativeTokenInfo();
+        delete[] perms;
+    }
+
+    class TextListener : public OnTextChangedListener {
+    public:
+        TextListener() {}
+        ~TextListener() {}
+        void InsertText(const std::u16string& text)
+        {
+        }
+        void DeleteBackward(int32_t length)
+        {
+        }
+        void SetKeyboardStatus(bool status)
+        {
+        }
+        void DeleteForward(int32_t length)
+        {
+        }
+        void SendKeyEventFromInputMethod(const KeyEvent& event)
+        {
+        }
+        void SendKeyboardInfo(const KeyboardInfo& status)
+        {
+        }
+        void MoveCursor(const Direction direction)
+        {
+        }
+    };
     constexpr size_t THRESHOLD = 10;
     constexpr int32_t OFFSET = 4;
     const std::u16string SYSTEMABILITY_INTERFACE_TOKEN = u"ohos.miscservices.inputmethod.IInputMethodSystemAbility";
@@ -40,10 +95,15 @@ namespace OHOS {
     }
     bool FuzzInputMethodSystemAbility(const uint8_t* rawData, size_t size)
     {
+        GrantNativePermission();
         uint32_t code = ConvertToUint32(rawData);
         rawData = rawData + OFFSET;
         size = size - OFFSET;
 
+        sptr<InputMethodController> imc = InputMethodController::GetInstance();
+        sptr<OnTextChangedListener> textListener = new TextListener();
+        imc->Attach(textListener);
+
         MessageParcel data;
         data.WriteInterfaceToken(SYSTEMABILITY_INTERFACE_TOKEN);
         data.WriteBuffer(rawData, size);

test/fuzztest/systemabilitystub_fuzzer/systemabilitystub_fuzzer.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021 Huawei Device Co., Ltd.
+ * Copyright (c) 2022 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at